@pushary/agent-hooks 0.49.1 → 0.51.0

package/dist/bin/pushary-claude.js

@@ -16,12 +16,14 @@ import {
   reportEvent,
   resolvePolicy,
   waitForAnswer
-} from "../chunk-O5MFSRWV.js";
+} from "../chunk-BEK4SJNX.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-Z5PL3K7C.js";
+import {
+  redactSecrets
+} from "../chunk-CJBVT33U.js";
 import {
   getApiKey,
   getBaseUrl
@@ -63,7 +65,7 @@ var SIGNAL_NUMBERS = {
 };
 var FORWARDED_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
 var runLocalPassthrough = (binary, args2) => {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let child;
     try {
       child = spawnClaude(binary, args2, {
@@ -71,7 +73,7 @@ var runLocalPassthrough = (binary, args2) => {
         env: { ...process.env, [WRAPPER_ACTIVE_ENV]: "1" }
       });
     } catch {
-      resolve(127);
+      resolve2(127);
       return;
     }
     const forward = (signal) => {
@@ -86,13 +88,13 @@ var runLocalPassthrough = (binary, args2) => {
     };
     child.on("error", () => {
       cleanup();
-      resolve(127);
+      resolve2(127);
     });
     child.on("exit", (code, signal) => {
       cleanup();
-      if (typeof code === "number") resolve(code);
-      else if (signal) resolve(128 + (SIGNAL_NUMBERS[signal] ?? 0));
-      else resolve(0);
+      if (typeof code === "number") resolve2(code);
+      else if (signal) resolve2(128 + (SIGNAL_NUMBERS[signal] ?? 0));
+      else resolve2(0);
     });
   });
 };
@@ -100,11 +102,194 @@ var runLocalPassthrough = (binary, args2) => {
 // src/wrapper/dualMode.ts
 import { basename } from "path";
 
+// src/transcript-sync.ts
+import { homedir } from "os";
+import { join as join2, resolve } from "path";
+import { existsSync, readFileSync } from "fs";
+
+// src/transcript-capture.ts
+import { createHash } from "crypto";
+
+// src/crypto.ts
+import nacl from "tweetnacl";
+var EPH_PUB_LEN = nacl.box.publicKeyLength;
+var BOX_NONCE_LEN = nacl.box.nonceLength;
+var SECRETBOX_NONCE_LEN = nacl.secretbox.nonceLength;
+var SESSION_KEY_LEN = nacl.secretbox.keyLength;
+var toBase64 = (bytes) => Buffer.from(bytes).toString("base64");
+var fromBase64 = (value) => new Uint8Array(Buffer.from(value, "base64"));
+var utf8Encode = (text) => new Uint8Array(Buffer.from(text, "utf-8"));
+var decodePublicKey = (value) => fromBase64(value);
+var generateSessionKey = () => nacl.randomBytes(SESSION_KEY_LEN);
+var wrapSessionKey = (sessionKey, accountPublicKey) => {
+  const ephemeral = nacl.box.keyPair();
+  const nonce = nacl.randomBytes(BOX_NONCE_LEN);
+  const box = nacl.box(sessionKey, nonce, accountPublicKey, ephemeral.secretKey);
+  const bundle = new Uint8Array(EPH_PUB_LEN + BOX_NONCE_LEN + box.length);
+  bundle.set(ephemeral.publicKey, 0);
+  bundle.set(nonce, EPH_PUB_LEN);
+  bundle.set(box, EPH_PUB_LEN + BOX_NONCE_LEN);
+  return toBase64(bundle);
+};
+var encryptRecord = (plaintext, sessionKey) => {
+  const nonce = nacl.randomBytes(SECRETBOX_NONCE_LEN);
+  const box = nacl.secretbox(utf8Encode(plaintext), nonce, sessionKey);
+  const bundle = new Uint8Array(SECRETBOX_NONCE_LEN + box.length);
+  bundle.set(nonce, 0);
+  bundle.set(box, SECRETBOX_NONCE_LEN);
+  return toBase64(bundle);
+};
+
+// src/transcript-capture.ts
+var INTERNAL_TYPES = /* @__PURE__ */ new Set([
+  "file-history-snapshot",
+  "change",
+  "queue-operation",
+  "summary"
+]);
+var redactDeep = (value) => {
+  if (typeof value === "string") return redactSecrets(value);
+  if (Array.isArray(value)) return value.map(redactDeep);
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [key, inner] of Object.entries(value)) {
+      out[key] = redactDeep(inner);
+    }
+    return out;
+  }
+  return value;
+};
+var localIdFor = (parsed, rawLine) => typeof parsed.uuid === "string" && parsed.uuid.length > 0 ? parsed.uuid : createHash("sha256").update(rawLine).digest("hex").slice(0, 32);
+var buildTranscriptRecords = (lines, sessionKey, seen = /* @__PURE__ */ new Set()) => {
+  const records = [];
+  const nextSeen = new Set(seen);
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    const type = typeof parsed.type === "string" ? parsed.type : "";
+    if (INTERNAL_TYPES.has(type)) continue;
+    const localId = localIdFor(parsed, trimmed);
+    if (nextSeen.has(localId)) continue;
+    nextSeen.add(localId);
+    const content = encryptRecord(JSON.stringify(redactDeep(parsed)), sessionKey);
+    records.push({ localId, content });
+  }
+  return { records, seen: nextSeen };
+};
+
+// src/transcript-api.ts
+var fetchAccountPublicKey = async (apiKey) => {
+  try {
+    const res = await fetch(`${getBaseUrl()}/api/agent/encryption-account`, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return typeof data.publicKey === "string" && data.publicKey.length > 0 ? data.publicKey : null;
+  } catch {
+    return null;
+  }
+};
+var uploadTranscriptRecords = async (apiKey, params) => {
+  try {
+    const res = await fetch(`${getBaseUrl()}/api/agent/transcript`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+      body: JSON.stringify(params),
+      signal: AbortSignal.timeout(15e3)
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+};
+
+// src/transcript-sync.ts
+var transcriptsEnabled = () => process.env.PUSHARY_TRANSCRIPTS === "1";
+var claudeTranscriptPath = (cwd, sessionId) => {
+  const projectId = resolve(cwd).replace(/[^a-zA-Z0-9-]/g, "-");
+  const configDir = process.env.CLAUDE_CONFIG_DIR || join2(homedir(), ".claude");
+  return join2(configDir, "projects", projectId, `${sessionId}.jsonl`);
+};
+var createSyncState = () => ({
+  sessionKey: null,
+  wrappedKey: null,
+  seen: /* @__PURE__ */ new Set(),
+  keyUploaded: false
+});
+var syncTick = async (lines, state, uploader, sessionId, machineId) => {
+  let sessionKey = state.sessionKey;
+  let wrappedKey = state.wrappedKey;
+  if (!sessionKey) {
+    const publicKey = await uploader.fetchAccountPublicKey();
+    if (!publicKey) return state;
+    sessionKey = generateSessionKey();
+    wrappedKey = wrapSessionKey(sessionKey, decodePublicKey(publicKey));
+  }
+  const built = buildTranscriptRecords(lines, sessionKey, state.seen);
+  if (built.records.length === 0) {
+    return { sessionKey, wrappedKey, seen: built.seen, keyUploaded: state.keyUploaded };
+  }
+  const ok = await uploader.uploadRecords({
+    sessionId,
+    machineId,
+    dataEncryptionKey: state.keyUploaded ? void 0 : wrappedKey ?? void 0,
+    records: built.records
+  });
+  return {
+    sessionKey,
+    wrappedKey,
+    seen: ok ? built.seen : state.seen,
+    keyUploaded: state.keyUploaded || ok
+  };
+};
+var readLines = (path) => {
+  try {
+    return existsSync(path) ? readFileSync(path, "utf-8").split("\n") : [];
+  } catch {
+    return [];
+  }
+};
+var startTranscriptSync = (opts) => {
+  const uploader = {
+    fetchAccountPublicKey: () => fetchAccountPublicKey(opts.apiKey),
+    uploadRecords: (params) => uploadTranscriptRecords(opts.apiKey, params)
+  };
+  const path = claudeTranscriptPath(opts.cwd, opts.sessionId);
+  let state = createSyncState();
+  let running = true;
+  let inFlight = false;
+  const tick = async () => {
+    if (!running || inFlight) return;
+    inFlight = true;
+    try {
+      state = await syncTick(readLines(path), state, uploader, opts.sessionId, opts.machineId);
+    } catch {
+    } finally {
+      inFlight = false;
+    }
+  };
+  const timer = setInterval(() => void tick(), opts.intervalMs ?? 3e3);
+  if (typeof timer.unref === "function") timer.unref();
+  void tick();
+  return () => {
+    running = false;
+    clearInterval(timer);
+  };
+};
+
 // src/wrapper/sdkLoader.ts
 import { spawn } from "child_process";
-import { existsSync, mkdirSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { join as join2 } from "path";
+import { existsSync as existsSync2, mkdirSync, writeFileSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
 import { pathToFileURL } from "url";
 var userMessage = (text) => ({
   type: "user",
@@ -114,8 +299,8 @@ var userMessage = (text) => ({
 var SDK_VERSION = "0.3.207";
 var SDK_PACKAGE = "@anthropic-ai/claude-agent-sdk";
 var SDK_SPEC = `${SDK_PACKAGE}@${SDK_VERSION}`;
-var sdkCacheDir = () => process.env.PUSHARY_REMOTE_SDK_DIR?.trim() || join2(homedir(), ".pushary", "remote-sdk");
-var cachedSdkEntry = () => join2(sdkCacheDir(), "node_modules", "@anthropic-ai", "claude-agent-sdk", "sdk.mjs");
+var sdkCacheDir = () => process.env.PUSHARY_REMOTE_SDK_DIR?.trim() || join3(homedir2(), ".pushary", "remote-sdk");
+var cachedSdkEntry = () => join3(sdkCacheDir(), "node_modules", "@anthropic-ai", "claude-agent-sdk", "sdk.mjs");
 var importSdk = async (specifierOrUrl) => {
   try {
     const mod = await import(specifierOrUrl);
@@ -130,7 +315,7 @@ var loadClaudeSdk = async () => {
   const fromResolution = await importSdk(SDK_PACKAGE);
   if (fromResolution) return fromResolution;
   const entry = cachedSdkEntry();
-  if (existsSync(entry)) return importSdk(pathToFileURL(entry).href);
+  if (existsSync2(entry)) return importSdk(pathToFileURL(entry).href);
   return null;
 };
 var ensureClaudeSdk = async (log) => {
@@ -139,8 +324,8 @@ var ensureClaudeSdk = async (log) => {
   const dir = sdkCacheDir();
   try {
     mkdirSync(dir, { recursive: true });
-    const pkgJson = join2(dir, "package.json");
-    if (!existsSync(pkgJson)) {
+    const pkgJson = join3(dir, "package.json");
+    if (!existsSync2(pkgJson)) {
       writeFileSync(pkgJson, `${JSON.stringify({ name: "pushary-remote-sdk", private: true })}
 `);
     }
@@ -149,14 +334,14 @@ var ensureClaudeSdk = async (log) => {
   }
   log?.("[pushary] setting up phone control (one-time, fetching the Claude Agent SDK)...");
   const npmCmd = process.platform === "win32" ? "npm.cmd" : "npm";
-  const installed = await new Promise((resolve) => {
+  const installed = await new Promise((resolve2) => {
     const child = spawn(
       npmCmd,
       ["install", "--no-optional", "--no-audit", "--no-fund", "--loglevel=error", SDK_SPEC],
       { cwd: dir, stdio: "ignore", shell: process.platform === "win32" }
     );
-    child.on("error", () => resolve(false));
-    child.on("close", (code) => resolve(code === 0));
+    child.on("error", () => resolve2(false));
+    child.on("close", (code) => resolve2(code === 0));
   });
   if (!installed) {
     log?.(`[pushary] could not auto-install the SDK. Install it manually: npm i -g ${SDK_SPEC}`);
@@ -185,10 +370,10 @@ var BoundedInputQueue = class {
     if (this.closed) return;
     this.pushedCount++;
     if (this.waiter) {
-      const resolve = this.waiter;
+      const resolve2 = this.waiter;
       this.waiter = void 0;
       this.deliveredCount++;
-      resolve({ value: item, done: false });
+      resolve2({ value: item, done: false });
       return;
     }
     this.buffer.push(item);
@@ -205,9 +390,9 @@ var BoundedInputQueue = class {
     this.closed = true;
     this.buffer.length = 0;
     if (this.waiter) {
-      const resolve = this.waiter;
+      const resolve2 = this.waiter;
       this.waiter = void 0;
-      resolve({ value: void 0, done: true });
+      resolve2({ value: void 0, done: true });
     }
   }
   // End the CURRENT consumer without closing the queue, so a fresh query can
@@ -216,9 +401,9 @@ var BoundedInputQueue = class {
   // instead of hanging on a promise that would otherwise never settle.
   detachConsumer() {
     if (this.waiter) {
-      const resolve = this.waiter;
+      const resolve2 = this.waiter;
       this.waiter = void 0;
-      resolve({ value: void 0, done: true });
+      resolve2({ value: void 0, done: true });
     }
   }
   // Drop every buffered item without closing the queue. Used when phone control
@@ -257,8 +442,8 @@ var BoundedInputQueue = class {
             new Error("BoundedInputQueue: concurrent consumers are not supported")
           );
         }
-        return new Promise((resolve) => {
-          this.waiter = resolve;
+        return new Promise((resolve2) => {
+          this.waiter = resolve2;
         });
       },
       return: () => {
@@ -300,8 +485,8 @@ var createRemoteApprover = (deps) => {
     const deadline = now() + windowMs;
     while (now() < deadline && !entry.controller.signal.aborted) {
       const remaining = Math.min(Math.max(deadline - now(), 1e3), 3e4);
-      const abortPromise = new Promise((resolve) => {
-        entry.controller.signal.addEventListener("abort", () => resolve({ answered: false, aborted: true }), {
+      const abortPromise = new Promise((resolve2) => {
+        entry.controller.signal.addEventListener("abort", () => resolve2({ answered: false, aborted: true }), {
           once: true
         });
       });
@@ -343,7 +528,7 @@ var createRemoteApprover = (deps) => {
       const sessionId = deps.getSessionId?.();
       const modeState = await fetchModeState2(deps.apiKey, sessionId);
       if (modeState.kill) return deny("Stopped by user \u2014 this agent was halted from Pushary");
-      const policyConfig = await getPolicy2(deps.apiKey, modeState.policyVersion);
+      const policyConfig = await getPolicy2(deps.apiKey, modeState.policyVersion, "claude_code");
       const policy = resolvePolicy2(policyConfig, toolName, modeState.mode, input);
       if (policy.timeoutSeconds === 0 && policy.timeoutAction === "approve") return allow(input);
       if (policy.timeoutSeconds === 0 && policy.timeoutAction === "deny") {
@@ -878,7 +1063,7 @@ var nativeArgs = (session) => {
 };
 var runLocalLeg = (session, deps = {}) => {
   const spawn2 = deps.spawn ?? spawnClaude;
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const legAbort = new AbortController();
     let exitReason = null;
     let settled = false;
@@ -886,7 +1071,7 @@ var runLocalLeg = (session, deps = {}) => {
       if (settled) return;
       settled = true;
       session.setActiveLeg(null);
-      resolve(exitReason ?? { type: "exit", code: 0 });
+      resolve2(exitReason ?? { type: "exit", code: 0 });
     };
     const control = {
       onPhoneCommand: () => {
@@ -1183,12 +1368,20 @@ var runDualMode = async (binary, args2, startingMode) => {
     }).catch(() => {
     });
   };
+  let stopTranscript;
+  let transcriptStarted = false;
+  const ensureTranscriptSync = () => {
+    if (transcriptStarted || !transcriptsEnabled() || !sessionId) return;
+    transcriptStarted = true;
+    stopTranscript = startTranscriptSync({ apiKey, sessionId, cwd: process.cwd(), machineId });
+  };
   const setSessionId = (id) => {
     const isNew = sessionId !== id;
     sessionId = id;
     sessionCreated = true;
     relay?.reannounce();
     if (isNew) void announcePresence("session_start", "Remote session ready \u2014 reachable from your phone");
+    ensureTranscriptSync();
   };
   const onPhoneCommand = (command) => {
     if (!remoteAvailable) {
@@ -1271,6 +1464,7 @@ var runDualMode = async (binary, args2, startingMode) => {
         "[pushary] reachable from your phone \u2014 send an instruction from the app when this goes idle (Ctrl-] keeps the terminal).\n"
       );
       void announcePresence("session_start", "Session ready \u2014 reachable from your phone");
+      ensureTranscriptSync();
     }
     if (startingMode === "remote" && initialPrompt) input.push(userMessage(initialPrompt));
     const exitCode = await driveModeLoop({
@@ -1300,6 +1494,7 @@ var runDualMode = async (binary, args2, startingMode) => {
     process.removeListener("exit", restoreStdin);
     relay?.stop();
     poller.stop();
+    stopTranscript?.();
     approver.teardown();
     input.close();
     stdin.dispose();

package/dist/bin/pushary-clean.js

@@ -6,15 +6,15 @@ import {
   removeCodexHooks,
   removeGeminiSettings,
   removeInstructionBlock
-} from "../chunk-SVVEC4QV.js";
+} from "../chunk-ORKNGSJI.js";
 import {
   execNpm
 } from "../chunk-J7JWI3KU.js";
 import {
   removeClaudeMcpServers,
   removePusharySettings
-} from "../chunk-7EW3USQF.js";
-import "../chunk-Z5PL3K7C.js";
+} from "../chunk-K74PMS6N.js";
+import "../chunk-CJBVT33U.js";
 
 // bin/pushary-clean.ts
 import { existsSync, readFileSync, writeFileSync, rmSync, readdirSync } from "fs";

package/dist/bin/pushary-codex-hook.js

@@ -31,21 +31,21 @@ import {
   toCodexWire,
   toPolicyLookup,
   waitForAnswer
-} from "../chunk-O5MFSRWV.js";
+} from "../chunk-BEK4SJNX.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-R5AJNXZS.js";
+} from "../chunk-LRGSMQH2.js";
 import "../chunk-DWED7BS3.js";
 import {
   DECISION_LINE_MAX,
   effectiveWaitSeconds,
   hookWaitClamped,
   hookWaitDeadline
-} from "../chunk-Z5PL3K7C.js";
+} from "../chunk-CJBVT33U.js";
 import {
   getApiKey
 } from "../chunk-NKXSILEW.js";
@@ -170,7 +170,7 @@ var decidePermissionRequest = async (input) => {
     const modeState = await fetchModeState(apiKey, input.session_id);
     if (modeState.kill) return codexDeny(KILL_REASON);
     const lookup = toPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd);
-    const policy = await getPolicy(apiKey, modeState.policyVersion);
+    const policy = await getPolicy(apiKey, modeState.policyVersion, "codex");
     const toolPolicy = resolvePolicy(policy, lookup.tool, modeState.mode, lookup.input);
     if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "approve") return codexAllow();
     if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "deny") {
@@ -229,7 +229,7 @@ var decidePreToolUse = async (input) => {
     const modeState = await fetchModeState(apiKey, input.session_id);
     if (modeState.kill) return codexDeny(KILL_REASON);
     const lookup = toPolicyLookup(input.tool_name ?? "", input.tool_input ?? {}, input.cwd);
-    const policy = await getPolicy(apiKey, modeState.policyVersion);
+    const policy = await getPolicy(apiKey, modeState.policyVersion, "codex");
     const toolPolicy = resolvePolicy(policy, lookup.tool, modeState.mode, lookup.input);
     if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "approve") return codexPass();
     if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "deny") {

package/dist/bin/pushary-codex.js

@@ -3,12 +3,12 @@ import {
   askUser,
   reportEvent,
   waitForAnswer
-} from "../chunk-O5MFSRWV.js";
+} from "../chunk-BEK4SJNX.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-Z5PL3K7C.js";
+import "../chunk-CJBVT33U.js";
 import {
   getApiKey
 } from "../chunk-NKXSILEW.js";

package/dist/bin/pushary-daemon.js

@@ -26,6 +26,18 @@ var MAX_ERROR_STREAK = 6;
 var REQUEST_TIMEOUT_MS = 1e4;
 var MAX_SPAWNS_PER_WINDOW = 5;
 var SPAWN_WINDOW_MS = 6e4;
+var NATIVE_AGENT_BINARIES = { codex: "codex", gemini: "gemini" };
+var buildSpawnLaunch = (req, opts) => {
+  const agent = req.agent === "codex" || req.agent === "gemini" ? req.agent : "claude";
+  const model = typeof req.model === "string" && req.model.length > 0 ? ["--model", req.model] : [];
+  if (agent === "claude") {
+    const claudeArgs = ["claude", "--remote", ...model, "-p", req.prompt];
+    return opts.spawnDirect ? { direct: true, command: opts.execPath, args: [opts.siblingEntry, ...claudeArgs], agent } : { direct: false, command: opts.pusharyBin, args: claudeArgs, agent };
+  }
+  const command = opts.resolveNative(NATIVE_AGENT_BINARIES[agent]);
+  const args = agent === "codex" ? ["exec", ...model, req.prompt] : [...model, "-p", req.prompt];
+  return { direct: false, command, args, agent };
+};
 var spawnRateAllows = (timestamps, now, maxPerWindow = MAX_SPAWNS_PER_WINDOW, windowMs = SPAWN_WINDOW_MS) => {
   while (timestamps.length > 0 && now - timestamps[0] > windowMs) timestamps.shift();
   return timestamps.length < maxPerWindow;
@@ -55,13 +67,20 @@ var runSpawnDaemon = async () => {
   const launch = (req) => {
     spawnTimestamps.push(Date.now());
     const cwd = req.cwd && existsSync(req.cwd) ? req.cwd : process.cwd();
-    const args = ["claude", "--remote", "-p", req.prompt];
+    const env = { ...process.env, PUSHARY_SPAWN_ID: req.id };
+    const plan = buildSpawnLaunch(req, {
+      spawnDirect,
+      execPath: process.execPath,
+      siblingEntry,
+      pusharyBin,
+      resolveNative: (name) => resolveGlobalBinary(name) ?? name
+    });
     try {
-      const child = spawnDirect ? spawn(process.execPath, [siblingEntry, ...args], { cwd, detached: true, stdio: "ignore", env: process.env }) : spawnClaude(pusharyBin, args, { cwd, detached: true, stdio: "ignore", env: process.env });
+      const child = plan.direct ? spawn(plan.command, plan.args, { cwd, detached: true, stdio: "ignore", env }) : spawnClaude(plan.command, plan.args, { cwd, detached: true, stdio: "ignore", env });
       child.on("error", (err) => stderr(`[pushary] could not launch session: ${err.message}
 `));
       child.unref();
-      stderr(`[pushary] launched a phone-requested session in ${basename(cwd)}
+      stderr(`[pushary] launched a phone-requested ${plan.agent} session in ${basename(cwd)}
 `);
     } catch (err) {
       stderr(`[pushary] could not launch session: ${err instanceof Error ? err.message : String(err)}

package/dist/bin/pushary-doctor.js

@@ -11,18 +11,18 @@ import {
   missingGeminiHookEvents,
   readCodexMcpAuth,
   untrustedCodexHookEvents
-} from "../chunk-SVVEC4QV.js";
+} from "../chunk-ORKNGSJI.js";
 import {
   execNpm
 } from "../chunk-J7JWI3KU.js";
 import {
   readLedgerSummary
-} from "../chunk-R5AJNXZS.js";
+} from "../chunk-LRGSMQH2.js";
 import {
   callMcpTool,
   sendMcpRequest
 } from "../chunk-DWED7BS3.js";
-import "../chunk-Z5PL3K7C.js";
+import "../chunk-CJBVT33U.js";
 import {
   getBaseUrl
 } from "../chunk-NKXSILEW.js";

package/dist/bin/pushary-gemini-hook.js

@@ -23,21 +23,21 @@ import {
   savePendingQuestion,
   sendNotification,
   waitForAnswer
-} from "../chunk-O5MFSRWV.js";
+} from "../chunk-BEK4SJNX.js";
 import {
   getMachineId
 } from "../chunk-RN3NOEJF.js";
 import {
   isGatingMoment,
   recordKeylessMoment
-} from "../chunk-R5AJNXZS.js";
+} from "../chunk-LRGSMQH2.js";
 import "../chunk-DWED7BS3.js";
 import {
   DECISION_LINE_MAX,
   effectiveWaitSeconds,
   hookWaitClamped,
   hookWaitDeadline
-} from "../chunk-Z5PL3K7C.js";
+} from "../chunk-CJBVT33U.js";
 import {
   getApiKey
 } from "../chunk-NKXSILEW.js";
@@ -209,7 +209,7 @@ var decideBeforeTool = async (input) => {
     const modeState = await fetchModeState(apiKey, input.session_id);
     if (modeState.kill) return geminiDeny(KILL_REASON);
     const lookup = toGeminiPolicyLookup(input.tool_name ?? "", input.tool_input ?? {});
-    const policy = await getPolicy(apiKey, modeState.policyVersion);
+    const policy = await getPolicy(apiKey, modeState.policyVersion, "gemini_cli");
     const toolPolicy = resolvePolicy(policy, lookup.tool, modeState.mode, lookup.input);
     if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "approve") return geminiAllow();
     if (toolPolicy.timeoutSeconds === 0 && toolPolicy.timeoutAction === "deny") {

package/dist/bin/pushary-hook.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   handlePreToolUse
-} from "../chunk-OQMEGREX.js";
-import "../chunk-7EW3USQF.js";
+} from "../chunk-ZIQKFF4S.js";
+import "../chunk-K74PMS6N.js";
 import "../chunk-KQYIHZ5E.js";
-import "../chunk-O5MFSRWV.js";
+import "../chunk-BEK4SJNX.js";
 import "../chunk-RN3NOEJF.js";
-import "../chunk-R5AJNXZS.js";
+import "../chunk-LRGSMQH2.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-Z5PL3K7C.js";
+import "../chunk-CJBVT33U.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-hook.ts

package/dist/bin/pushary-notification-hook.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   handleNotification
-} from "../chunk-O5MFSRWV.js";
+} from "../chunk-BEK4SJNX.js";
 import "../chunk-RN3NOEJF.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-Z5PL3K7C.js";
+import "../chunk-CJBVT33U.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-notification-hook.ts

package/dist/bin/pushary-permission-denied-hook.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   handlePermissionDenied
-} from "../chunk-OQMEGREX.js";
-import "../chunk-7EW3USQF.js";
+} from "../chunk-ZIQKFF4S.js";
+import "../chunk-K74PMS6N.js";
 import "../chunk-KQYIHZ5E.js";
-import "../chunk-O5MFSRWV.js";
+import "../chunk-BEK4SJNX.js";
 import "../chunk-RN3NOEJF.js";
-import "../chunk-R5AJNXZS.js";
+import "../chunk-LRGSMQH2.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-Z5PL3K7C.js";
+import "../chunk-CJBVT33U.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-permission-denied-hook.ts

package/dist/bin/pushary-permission-hook.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import {
   handlePermissionRequest
-} from "../chunk-OQMEGREX.js";
-import "../chunk-7EW3USQF.js";
+} from "../chunk-ZIQKFF4S.js";
+import "../chunk-K74PMS6N.js";
 import "../chunk-KQYIHZ5E.js";
-import "../chunk-O5MFSRWV.js";
+import "../chunk-BEK4SJNX.js";
 import "../chunk-RN3NOEJF.js";
-import "../chunk-R5AJNXZS.js";
+import "../chunk-LRGSMQH2.js";
 import "../chunk-DWED7BS3.js";
-import "../chunk-Z5PL3K7C.js";
+import "../chunk-CJBVT33U.js";
 import "../chunk-NKXSILEW.js";
 
 // bin/pushary-permission-hook.ts